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I, CHRIS DiBONA, declare under penalty of perjury that the foregoing is true and 


correct: 


1. Iam presently employed by VA Linux Systems, Inc. ("VA Linux"), which is the 
country's leading company providing hardware and software products for Linux users and 

Internet Infrastructure companies. A copy of my Resume is attached hereto as Exhibit A. 

DEFENDANT' 

EXHIBIT 
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2. Linux is an operating system designed from the ground up to be distributed in an 
open manner. One of the things that makes Linux different from other commercial offerings is 
the fact that it is not owned by any one person, organization or company. Developed over the last 
decade over the internet, Linux was released under the GNU General Public License ("GPL"). 

The GPL license provides that anyone can use Linux, but they must promise to make any 

I 

program derived from or based on the Linux source code open and freely available in its turn, so 
as to promote the spread of the Linux and similai softwaie. By its \lij natuic, Linux is an open 

system. 

3. During the early development of Linux, it was very rare for a manufacturer of a 
device (say a DVD player, printer, video or sound card) to provide specifications or even 
technical help to the people who wanted that same device to work with Linux. Commonly, a 
programmer would reverse engineer the device to ensure that device worked under Linux. 

4 I have very closelv followed the efforts of various individuals and/oi gioups to 
develop a DVD player for machines using the Linux operating system (as well as for other open- 
source operating systems), including those of the international LiVid group. I have also follow ed 
with great attention the related efforts by some individuals and/or groups to "crack" the CSS code 
that encrypts the data on DVDs as part of their endeavor to create an open-source DVD player. 
Such a step is necessary to enable DVD players not equipped with CSS, such as players for use 
on Linux and other open source platforms, to read or play commercial DVDs. 

5. I have reviewed this Court's preliminary injunction decision — w'hich is posted 
online at a variety of web sites, including a number of web sites on the 2600.com mirror list as 
posting DeCSS — and am aw'are of the Court's apparent belief that DeCSS poses a great risk of 
copying by "pirates" who could use DeCSS to create innumerable, commercially viable, 
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infringing digital copies of a DVD movie. 


Based on my experience, my expertise with the 


necessary technology, and the investigation described below, it is patently clear to me that this 
conclusion is factually incorrect. Additionally, the Court’s apparent belief that the only reason 
for DeCSS is for copying is also incorrect. For example, Jon Johansen, the Norwegian 16-year- 
old who first posted DeCSS and is a member of MoRE (“Masters of Reverse Engineering”), the 
group that developed the utility, stated in a January 31, 2000 interview reported on CNN.Com: 

“I o 0 t involved with DVD about two years ago [a]nd about at the end of September last 

vear I cot in contact with a German Computer programmer and a Dutch computer programmer, 

J 5 C? 


and we decided that it was time to add DVD support to Linux - and, of course, to opther 
operating systems, such as FreeBSD.” A copy of the interview is attached hereto as Exhibit B. 

6. I have no personal knowledge of anyone using DeCSS to view or copy a DVD, 
except for a single professional demonstration presented by OpenDVD.org at the Atlanta Linux 

Showcase trade show at which DeCSS was used to play (but not copy) a DVD. 

7. In early April, 1 was asked by counsel for the defendants in this lawsuit to 

investigate the use by the Linux community - and/or anyone else - of DeCSS in any context, 


including to view or copy DVDs. Accordingly, in addition to my constant contacts and 
conversations with members of the Linux community, between April 1 Oth and April 20th I 
posted general inquiries about DeCSS-related copying to the Linux, other open-source, and 
"hacker" (in the non-perjorative sense of individuals devoted to exploring the limits of the 
Internet) communities via a variety of mailing list and websites, including but not limited to the 
SVLUG and DeCSS mailing lists and the opendvd.org website. These communities are made 

up of very skilled and technically capable people. 
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8. None of the approximately 2000 people who responded to my e-mails and 
postings reported using DeCSS to make copies of DVDs. Indeed, only two people - both of 
whom insisted on strict anonymity as a condition of speaking with me because they feared 
reprisal from the MPAA - said that they were able to use DeCSS to view DVDs they had 
purchased. However, both reported significant problems with playback. One experienced 
distorted video and both experienced stuttering sound. It's also worth noting that the individual 
who called the video "high quality" (although with bad sound) used a very expensive dual 
processing computer equipped with a great deal of random access memory. 

9. There are several explanations for the results obtained by these isolated 
experiments. First, it is technically quite complicated to use DeCSS to copy DVDs. Starting 
with the DVD player, you'd need to acquire and make use of the DeCSS utility. Additionally, 
some sort of MPEG decoding utility would be necessary to view the resulting decoded data. 

Since the algorithms used by the MPEG display software are especially cpu (the central 
processing unit or chip that runs a computer) and memory intensive, and because the developers 
of the DeCSS application were unable to enlist the help of any hardware decoder that may exist 
on the video card, the resulting video quality is very poor. 

10. Except under a very specific and unusual set of circumstances (I am hypothesizing 
that such circumstances are possible, since as far as I am aware, it hasn't yet been done), it is also 
nearly impossible to enjoy a DVD played through DeCSS because of the syncing problems that 
make movies appear like dubbed martial arts films. When one combines the poor playback 
quality created by these technical difficulties with the exceptionally large size of the data files, 
which makes the copying and distribution of decrypted versions of movies from a DVD so costly 
and complicated as to be unfeasible, it is clear that DeCSS is not a useful tool for the piracy, let 
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alone viewing, of DVDs. 

11 In or der to test the theories and information I had gleaned about the DeCSS 
program, and to understand the technical aspects of using it, I downloaded DeCSS.exe and 
installed it on my DVD equipped Laptop. Before executing DeCSS, I tried to copy some of the 
VOB files off of the DVD of Air Force One that was specifically procured for this task. I was 
unable to copy over the file until after I had run DeCSS on the drive to unlock the data, which 
confirmed that DeCSS permits one to copy a file off a DVD onto a computer's hard drive. 
However, the only DVD plaver program I had on my computet refused to play any of the VOB 
files I had copied directly off the hard drive (I did not copy all of them because of lack of room 
on my 18-gB hard drive). I was also unable to find a program under windows that would play the 

VOB file. 

12. I w'as able to play the VOB file under Linux using a free utility called xmovie . 

(x denotes that this is a movie player for the xwindows system, the windowing environment used 
by Linux and Unix). My experience was that with some tweaking 1 was able to watch the VOB 
file, but that video quality w'as very poor, showing a lot of stuttering and with a great deal of 
artifacts, and the sound, while clear enough, w'as not synchronized with the picture very well. 

This was the first time I was able to watch even a fragment of a DVD (which I had purchased) 
using Linux; but it took me hours to accomplish this task, and I used a DVD I already ow'ned and 
could play on my home player and laptop computer. 

13. Having laboriously used DeCSS to view a fragment of a commercially purchased 
DVD, my conclusion is that it is not watchable by any degree. Apart from the extensive 
technical problems I experienced (and others I understand are discussed in other declarations), it 
is clear that any copies made for sale (i.e., pirated copies) using this system would share all of the 
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above-described defects. 


14. Accordingly, given the many problems and costs associated with using DeCSS, 
especially compared to the low price of buying or renting a DVD and the fact that new Windows 
and Apple computers increasingly provide a DVD player as standard equipment, it is my opinion 
that the only real commercial value in DeCSS is as part of the reverse engineering of an open- 
source DVD player and not at all as a tool for commercial piracy. This conclusion is also 
supported by the fact that none of the 2000 people who responded to my inquiries about DeCSS 

used the program to copy a DVD. 

1 5. In fact, DeCSS seems to me to have been created as an exercise in cryptology and 
the result of intellectual curiosity and experimentation by a handful of extremely sophisticated 
computer experts. Once open-source DVD players have been established, DeCSS’ only value 
will be as an interesting utility to be examined by academics, scholars, engineers, programmeis, 
cryptologists, and the like. 

16. After some thought, and through my actions working on this debate, I realized that 
may be in fact possible to copy the VOB files as I described in previous paragraphs, but without 
using DeCSS at all. I tested my theory on my Laptop, a IBM Thinkpad 600E with a DVD drive 
installed. 

17. IBM ships the Mediamatics DVD playing program with their DVD drive so that 
the user can watch DVD's in full screen under Windows. This works flawlessly under Windows. 
WTiat is interesting is that if you do the following, you can copy data off the Disk, and use the 
mediamatics program as a DeCSS equivalent. 
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18. First, I opened up the same movie and started it playing, then I minimized the 
window so that my screen was not completely filled by Harrison Ford. Using window's file 
manager, I then copied two of the VOB files on the Disk to the hard drive. Prior to my playing 
the movie (and the concommitant unlocking of the DVD Drive by the mediamatics player), I was 
unable to copy these same VOB files. 

19. After copying one of the files onto my hard drive, I shut down the mediamatics 
playing program. I discovered that upon the closing of the program the DVD was left unlocked. 
This 
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means you can copy the data from the DVD player while it is playing, or you can wait until you 
are done watching to copy the data. I copied over some more of the VOB files that I had been 
unable to copy before starting the MediaMatics program. The VOB file that was copied was still 

scrambled, but it was the data off the DVD drive. Conceivably you could make a bit for bit copy 
of the DVD in this manner. 

It should be clear that the DeCSS program by itself is not necessary to get the data files 
off the D\ D. The design of the protocol makes DeCSS redundant for that purpose. If a person is 
able to play a DVD on a Laptop, then the design of CSS demands that the DVD be unlocked. 
While a DVD is unlocked, you can copy whatever you want off the DVD. For the case of my 
laptop and the MediaMadics player I was able to not only copy the VOB file I was currently 
viewing, I was able to copy all other files. That said, I’d be surprised if this was not the case for 
the other playeis. The design of the DVD copy protection is flawed in such a way as to 
invalidate any assertion that CSS is a copy protection mechanism, since I can use the tools 
designed for it and licenced by the MPAA/DVD-CCA to copy VOB files. 
lil.'N', If the DeCSS program is not even needed to circumvent the copy protection on the DVD, 
DeCSS should be seen as a method of descrambling only, as copy protection is invalidated by 
the design of the DVD itself. The fact that the files can be removed without DeCSS means that 
bit-by-bit copies of the DVDs could be made using the necessary equipment. It may even be 

possible to make a CSS-equipped DVD player run the encrypted VOB files directly off a hard 

drive without the benefit of any assisting software. 

Dated: May 1 , 2000 
Sunnyvale, California 
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Christopher James DiBona 


1334 Holly Ave 
Los Altos, Ca 94024 
chris@dibona.com 

408-621-7046 (cell) 650-961-6040(home) 


OBJECTIVES: 

To further the state of the art in programming for the net and to help in the guidance of new 
technologies to fruition. 


WORK EXPERIENCE 


November 1998 Ongoing, VA Linux Systems Sunnyvale, Ca 

In Order: 

The Marketing Department 
The Web Team 
Director of Tech Support 

On the IPO team (Ran the TOT team which help 1550 participants) 

Linux Community Evangelist 
Technology Lead on our MCA Team 

2 I was the 14 :1 ’ Employee of VA Linux systems, as such, I was asked to do a lot of different, very 
challenging jobs. 


June 1998 November 1998, StrongCrpyto LLC.San Francisco, Ca 
Chief A rchitect 

a Developed the architecture for a next generation VPN/Crpyography Product. Company failed, was 
never funded and dissolved. 


February 1998 July 1998, SuSE GMBH. Oakland, Ca 

Web Site Redevelopment 

S Planned and executing the redevelopment of their web site for internationalization and for 
streamlined online ordering with a shopping cart application. 

July 1996 -March 199S Tandem Computers Cupertino, Ca. 

Software Developer , Security Technology Products. 

1334 HOLLY AVE LOS ALTOS, CA 94024 (H) 650-961-6040 (\V) 408-542-8600 
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Ej W,s part of the team that created the Tandem Certificate Security Server Duties included 
development in C+ + under Solaris and NT. In charge of developing the interface between our 

product and various smart card readers. 


1995 - June, 1996 Howrey & Simon Washington, DC 

Electronic Messaging Administrator 

a Maintained a multi-platform mail systems consisting of over 60 sites with 1200 -f users on many 
mail platforms, including, but not limited to, MS Mail on the Mac & PC, CC-Mail, SMTP, X.400 
and recently, MS Exchange. Helped to develop Howrey s intranet capabilities and assisted m 

network operations. 


1993 - 1995 US Department of State A/IM Washington, DC 

Programmer/ A nalyst 

(j 

a Developed prototype applications within the demanding security framework and network 
environment of the Department. (270+ sites worldwide). I was the NS A trained and certified 
fortezza crypto-card subject matter expert for the department and was on their firewall 

implementation team. 


1992-1996 Freelance Animator DC. Metropolitan Area 

E Animated flvin a losios and product demos for Telepad Corporation, as well as for the Capital 
Management group of companies. 


EDUCATION 


1993 - 1996 George Mason University Fairfax, Va. 

Bachelors in Computer Science 

S To be received 2000. Emphasis on networking protocols & their 
operating system architectures. 


interactions with different 


1993 - 1996 Northern Virginia Community College Loudon, Va. 
Associates in Computer Science 


PROFESSIONAL MEMBJRSmPS 

Member in good standing of the Association of Computing Machinery. (ACM) I am the President of 
the Silicon Valley Linux Users Group. I am the SVLUG’s "webmaster as well, (http://www.svlug.org ) 
I am the Grant Chair for Linux International's Development fund. I am on the technical board of 
Ciphony Corporation and Paragon/Digital Education Systems’ and I am the Linux Conference chair 
for the O'REilly Open Source Conference, an avisory Chair for YAPC and assist in the Conference 
planning for LinuxWorld Conference and Expo. 


REFERENC ES 

John Clark, Deputy Assistant Secretary of State for information management, US Department of 

State. 


1334 HOLLY AVE LOS ALTOS, CA 94024 (H) 650-961-6040 (W) 40S-542-S600 
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Robert SanMartin, Former Chief Scientist, Department of Energy. 

Peter Sarros, Analyst, Information Management at the Department, former Ambassador to the 
Vatican. 

Larry Augustin, CEO VA Linux Systems 
Other references are available upon request. 

P ROJE CTS , AWARDS AND PU BLICATION S • 


I have bene published in all the major Linux press an quoted widely in both trade and mainstream 
publications including but not limited to USA Today, Time, the New York Times and others. 
Transcripts and tapes can be made available on request. I have been quoted in Techweek, C|net, 
BootNet and Wired Daily News. 

I co-edited the book "Open Sources: Voices from the Open Source Revolution", published by 
O'Pvcilly and associatcds. This book won the Linux Journal Best New Book award for 1999. 

Outside oi the computer field, I have been published as a freelance writer for human interest, 
international security and feature stories. I have reviewed books for Techweek and other print and 
online publications. 

My web-site has garnered recognition in both the national and cyber-press. Garnering mentions in The 
Net, Internet World, Online access and in a Vi dozen other publications. Also received “Point. corns” 
oft-given top 5% oi the web award, as well as a pair of “Yahoo” sunglasses. It recieves aapproximately 
between 50, 000-60, CGO page views a month. 

For more information and for online transcripts oi publications, visit http://www.dibona.com 


SECURITY CLEARANCE 


State Dept. Issued. Additional information available upon request to qualified entities, should be 
considered out of date. 
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(IDG) - On Monday, January 24, 
authorities in Norway searched the 
home of Jon Johansen, a 16-year-old G 

Norweaian member of the Masters of 

«• - • 

Reverse Engineering (MoRE) — the 
uroup which created the DeCSS DVD playback utility for Linux, 
and his father Per Johansen have both been indicted by Norway's 
Department of Economic Crime. 



Jon 


LinuxWorld talked to Jon about DeCSS, the investigation, the 
controversy — and about why he feels that this case is at the same time 
so ridiculous and so important. 


LinuxWorld: How did this whole thing start? How did you get 
involved with DVD and DeCSS? 
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Jon Johansen: Well, I got involved with DVD about two years ago. I 
bought my first DVD-ROM and an MPEG-2 decoder card. And, about 
at the end of September last year, I got in contact with a German 
computer programmer and a Dutch computer programmer, and we 
decided that it was time to add DVD support to Linux — and, of course, 
to other operating systems, such as FreeBSD. 


LinuxWorld: Had you expected any 
problems like this when you set about to 
make the player? 


^MESSAGE BOARD 

Linux 


Jon Johansen: We knew that they would probably go after someone. 
But when [Norwegian authorities] visited me yesterday with a search 


http://www.cnn.com/2000/TECH/computing/01/31/johansen.interview.idg/index.html 
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warrant, I really hadn’t expected them to, because it's been about two or 
three months now since [the subject] fust appeared in the media and, 
well, to me, that’s a pretty long time. 


LinuxWorld: You removed the code 
from your Webpages when they asked you 
to, and have been cooperating with what 
they have asked of you, is that right? 


MORE 


COMPUTING INTELLIGENCE 


J *. 

v - . n c\ IDG.net home page 
LinuxWorld's home page 


Jon Johansen: Actually, I was only 
linking [to the source code] and they 
wanted me to remove the link — which I 
did, so that I could think it over. And then 
the link appeared again on my Website at 
the end of the week. 


LinuxWorld free e-mail alerts 
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LinuxWorld: Did they question you at 
your house? 

Jon Johansen: No. They took me to the 
local police station. But my father was 
sick, so they questioned him here at home. 


Year 2000 World 

Questions about computers? Let 
IDG. net's editors help you 

Subscribe to IDG. net's free daily 
newsletter for IT leaders 

Search IDG.net in 12 languages 


LinuxWorld: But they just took you in 

for questioning -- they didn't arrest you or 
anything like that? 

* w 


News Radio 

^ ■ V Fusion audio primers 
Computerworld Minute 


Jon Johansen: Well, the biggest Norwegian newspaper regarded this 
as an arrest, since they hadn't told us that they were coming and they 
brought me in. So the biggest Norwegian newspaper looked upon that 

as an arrest. 


LinuxWorld: But did they give you a choice to not go in for 
questioning? 


Jon Johansen: Well, of course I do have the right to have an attorney 
present. So I [could have] told them that I did not want to do it without 
an attorney, [and] they would have had to call my attorney and schedule 
an appointment. 

LinuxWorld: And you didn't do that. 


Jon Johansen: No, I didn't do that. 


LinuxWorld: Why? 

Jon Johansen: Basically, because I didn't have anything to hide. So I 
decided to cooperate. 
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LinuxWorld: The code that you wrote - now, is it called DeCSS or is 
it CSS-auth? 

Jon Johansen: It's called DeCSS. 

LinuxWorld: OK. Because I've seen conflicting media reports on that, 
and other things. Like, some say that you are 15, others say you are 16. 

Jon Johansen: I'm 16 now, I was 15 when it happened ... and the 
encryption code wasn't in fact written by me, but written by the German 
member. There seems to be a bit of confusion about that part. 

LinuxWorld: The other two people that you had worked with to make 
the player are remaining anonymous — is that right? 

Jon Johansen: Yes, that is correct. 

LinuxWorld: Do you think they will try to find out who they are from 
the data on your computer? 

Jon Johansen: Yes, probably. They also asked what I knew about 
them. But I don't have the identity of any of them. I only had the nicks 
that they used on Internet Relay Chat. 

LinuxWorld: And did you give those up? 

Jon Johansen: Well, lately they have been changing nicks from time to 
time. So I cave one of the nicks thev had used before. 

w * 

LinuxWorld: Do you know why they want to remain anonymous? 

Jon Johansen: They are both a lot older than me, and they are 
employed. So I guess they just didn't want the publicity, and they were 
perhaps afraid of getting fired. 

LinuxWorld: And why is your father involved in this? 

Jon Johansen: Basically because he owns the domain [at which] my 
Webpages were located. 

LinuxWorld: And how do your parents feel about this whole thing? 

Jon Johansen: They consider it [to be] just as stupid as I do. The 
charge is totally off-topic. It doesn't have anything to do with reality. 

LinuxWorld: Do you know why they took your cell phone? 
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Jon Johansen: I asked them why, and they said that they considered it 
to be so advanced that they had to take it in, because it was a Nokia 9 1 - 
10. And I did have, in fact, a backup of the source on it. 

Linux Wo rid: And do you know what is going to happen next? 

Jon Johansen: They are currently investigating, and I still haven't 
received my computers back. So I have ordered a new one today, which 
I will be receiving on Friday. Which is a bit too late, because ABC 
News is coming tomorrow, and I was supposed to demonstrate DVD 
playback under Linux. So I'm going to call some people now and try to 
get hold of a computer with a DVD-ROM and get Linux installed on it. 

LinuxWorld: So, can DeCSS in fact in any way be used for pirating? I 
mean, I realize that isn't the purpose for which it was written. 

Jon Johansen: Well, yes, it can be used for pirating. Because you can 
decrypt a DVD disk and put it on your hard drive and then you can 
convert it, say, to VCD and then post it on the Internet. But tools to do 
that had already been available on the Internet, long before DeCSS, 
which was also a complete digital solution which gave you the same 
quality. So DeCSS didn't introduce anything new for pirating and had 
already been available. 

LinuxWorld: So why do you think they are going after you, and not 
the authors of the other tools? 

Jon Johansen: Well, the authors of the other tools are, as far as I 
know, anonymous. And [in] the charge, they say that the encryption is 
copy protection. But that's not correct at all. Anyone with a little 
computer experience knows that anything can be copied bit-by-bit with 
the right equipment. 

LinuxWorld: And the authors of the other tools didn't break the 
encryption? Those previous tools had been written for the Windows 
platform, is that right? 

Jon Johansen: Yes. There was one tool, I think it was called DVD-rip, 
which I believe actually hacked in to the Xing DVD player and then, 
when the Xing DVD player had decrypted the MPEG stream, the DVD- 
rip utility dumped that stream to disk and you had yourself an 
unencrypted DVD movie. 

LinuxWorld: Well, it seems then all the more that they should be 
going after those other authors. 

Jon Johansen: I guess it is because those other tools haven't received 
any media attention. But perhaps they don't even know about them — 
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but I would think that they do, because they are not that stupid. 

LinuxWorld: Why did you decide to come forward and to not to 
remain anonymous? 

Jon Johansen: We discussed it in the group and they thought it was 
OK, and I think the first reporter I talked to was from Wired. I think it 
was Declan [McCullugh], and he asked me if he could publish my 
name, and since we had already talked it over in MoRE, I said yes. 

LinuxWorld: Axe you sorry now that you did? 

Jon Johansen: Not really, because I think the fight we are now fighting 
is a very important fight for free speech and for the open source 
community'. 

LinuxWorld: Why is it so important? 

Jon Johansen: Basically, if reverse engineering is banned, then a lot of 
the open source community is doomed to fail. Because [you need to 
reverse-engineer] when creating software for compatibility with, for 
example, Microsoft Windows. For example, Samba was totally 
dependant on reverse engineering. Of course, the whole computer 
industry was allowed to reverse-engineer IBM's BIOS. 

LinuxWorld: What was your reaction to the injunctions in the US? 

Jon Johansen: I was a bit surprised, but then I read about how EFF 
[the Electronic Frontier Foundation] had presented the defense. And, if 
what I read on Slashdot about that was true, then I don't understand 
how exactly EFF could have areued that wav. 

w W * 

LinuxWorld: Why? 

Jon Johansen: Well, what I read on Slashdot was that they basically 
said that the encryption was bad, and it was kind of their fault. And I 
don't understand why they used those arguments. 

LinuxWorld: What kind of arguments would you have expected, or 
what kind of arguments do you think might have been better? 

Jon Johansen: I would have expected for them to try to explain to the 
court that this had nothing to do with copying, because encryption does 
not prevent copying — which the DVD CCA [Copy Control 
Association] and MPAA are claiming. And everybody knows that even 
if something is encrypted you can still copy it if the reading of the data 
goes through decryption. 

LinuxWorld: At the hearing I attended, the defense did argue that the 
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DVD encryption was flawed. At the same hearing, the plaintiffs had 
some really, some pretty strong feelings about the way people have 
been acting when they repost the code. Do you know about that? 

Jon Johansen: I did actually read on Slashdot where the plaintiffs had 
actually read from Slashdot debates. 

LinuxWorld: Exactly. And they picked out only the ones which were 
saying things like "fuck the law." And so they picked those out on 
purpose and they said, "Look at these people. They don't want to play 
back movies. They are saying 'fuck the law.'" So do you have anything 
to say to people about that? 

Jon Johansen: Well, that's really sad that they can't behave, because 
they should have known that the plaintiffs would have used something 
like that against us. They should stop doing things like that and help 
inform the media that this has nothing to do with copying but [rather 
has to do with] with playback. 

LinuxWorld: How best can people help to do that? 

Jon Johansen: Well, first of all they could head over to 
OpenDVD.org, and see what's written there, and then perhaps call or 
email their local media, and inform them about the case. 

LinuxWorld: Thanks, Jon. for talking to us. We wish vou the best of 
luck. 
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